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General Information 


QPDF is a program that does structural, content-preserving transformations on PDF files. QPDF's website is located 

at http://qpdf.sourceforge.net/. QPDF’s source code is hosted on github at https://github.com/qpdf/qpdf. 

QPDF is licensed under the Apache License, Version 2.0 [http://www.apache.Org/licenses/LICENSE-2.0] (the "Li¬ 
cense"). Unless required by applicable law or agreed to in writing, software distributed under the License is distributed 
on an "AS IS” BASIS. WITHOUT WARRAN! IES OR CONDITIONS OF ANY KIND, eithei express or implied. 
See the License for the specific language governing permissions and limitations under the License. 

Versions of qpdf prior to version 7 were released under the terms of the Artistic License, version 2.0 [https://open- 
somce.org/licenses/Artistic-2.01. At your option, you may continue to consider qpdi to be licensed under those terms. 
The Apache License 2.0 permits everything that the Artistic License 2.0 permits but is slightly less restrictive. Allow¬ 
ing the Artistic License to continue being used is primary to help people who may have to get specific approval to 
use qpdf in their products. 

QPDF is intentionally released with a permissive license. However, if there is some reason that the licensing terms 
don’t work for your requirements, please feel free to contact the copyright holder to make other arrangements. 

QPDF was originally created in 2001 and modified periodically between 2001 and 2005 during my employment at 
Apex CoVantage [http://w ww.apexcovantage.com]. Upon my departure from Apex, the company graciously allowed 
me to take ownership of the software and continue maintaining as an open source project, a decision for which 1 am 
very grateful. I have made considerable enhancements to it since that time. I feel fortunate to have worked for people 
who would make such a decision. This work would not have been possible without their support. 
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Chapter 1. What is QPDF? 

QPDF is a program that docs structural, content-preserving transformations on PDF tiles. It could have been called 
sometning like pdf-to-pdf. It also provides many useful capabilities to developers ot PDF-producing software or for 
people who just want to look at the innards of a PDF file to learn more about how they work. 

With QPDF, it is possible to copy objects from one PDF file into another and to manipulate the list of pages in a PDF 
file. This makes it possible to meige end split PDF files. 1 he QPDF library also makes it possible for you to create 
PDF files from scratch. In this mode, you are responsible for supplying all the contents of the file, while the QPDF 
library takes care off all the syntactical representation of the objects, creation of cross references tables and, if you 
use them, object streams, encryption, linearization, and other syntactic details. You are still responsible lor generating 
PDF content on your own. 

QPDF has been designed with very few external dependencies, and it is intentionally very lightweight. QPDF is not a 
PDF content creation library, a PDF viewer, or a program capable of converting PDF into other 1 ormats. In particular, 
QPDF knows nothing about ihe semantics of PDF content streams. If you are looking for something that can do tnat, 
you should look elsewhere. However, once you have a valid PDF file. QPDF can be used to transform that file in v, ays 
perhaps your original PDF creation can't handle. For example, many programs generate simple PDF files but can't 
password-protect them, web-optimize them, or perform other transformations of that type. 
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Chapter 2. Building and Installing 
QPDF 

This chapter describes how to build and install qpdf Please see also the README.md and INSTALL files in the source 
distribution. 

2.1. System Requirements 

The qpdf package has few external dependencies. In order to build qpdf, the following packages are required: 

• zlib: http://www.zlib.net/ 

• jpeg, http://www.iig.org/files/ or https://libjpeg-mrbo.org/ 

• gnu make 3.81 or newer: http://www.gnu.oig/software/make 

• perl version 5.8 or newer: http://www.perl.org/; required for fix-qdf and the test suite. 

• GNU diffutils (any version): http://www.gnu.org/software/diffutils/ is required to run the test suite. Note that this is 
the version of diff present on virtually all GNU/I inux systems. This is required because the test suite uses diff -u. 

• A C++ compiler that works well with STL and has the long long type. Most modem C++ compilers should fit 
the bill fine. QPDF is tested with gcc, clang, and Microsoft Visual C++. 

Part of qpdfs test suite does comparisons of the contents PDF files by converting them images and comparing the 
images The image comp arison tests are disabled by default Those tests are not required for determining correctness of 
a qpdf build if you have not modified the code since the test suite also contains expected output files that are compared 
literally. The image comparison tests provide an extra check to make sure that any content transformations don't break 
the rendering of pages. Transformations that affect the content streams themselves are off by default and are only 
provided to help developers look into the contents of PDF files. If you are making deep changes to the library that cause 
changes m the contents of the files that qpdf generates, then you should enable the image comparison tests. Enable 
them by running configure with the -enable-test-compare-images flag. If you enable this, the following additional 
requirements are required by the test suite Note that in no case are these items required to use qpdf. 

• libtiff: http.V/www .remotesensing.org/fibtiff/ 

• GhostScript version 8.60 or newer: http://www.ghostscript.com 

If you do not enable this, then you do not need to have tiff and ghostscript. 

If Adobe Reader is installed as acroread, some additional test cases will be enabled. These test cases simply verify 
that Adobe Reader can open the files that qpdf creates. They require version 8.0 or newer to pass. However, m order 
to avoid having qpdf depend on non-free (as in liberty) software, the test suite will still pass without Adobe reader, 
and the test suite still exercises the full functionality of the softw are. 

Pre-built documentation is distributed with qpdf. so you should generally not need to rebuild the documentation. In 
order to build the documentation from its docbook sources, you need the docbook XML style sheets (http://down- 
loads.sourceforge.net/docbook/). To build the PDF version of the documentation, you need Apache fop (http://xml.a- 
pache.org/fop/) version 0.94 or higher. 

2.2. Build Instructions 


Building qpdf on UNIX is generally just a matter of running 
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./configure 
make 


You can also run make check to run the test suite and make install to install. Please ran ./configure —help for options 
on what can be configured. You can also setflievalue of DESTDIR during installation to install to atemporary location, 
as is common with many open source packages. Please see also the README.md and INSTALL files in the source 
distribution. 

Building on Windows is a little bit more complicated. For details, please see READMF.-windows.md in the source 
distribution. You can also download a binary distribution for Windows. There is a port of qpdf to Visual C++ version 6 
in the contrib area generously contributed by Jian Ma. This is also discussed in more detail in README-^ indows.md. 

Theic are some other things you can do with the build. Although qpdf uses autoconf, it does not use automake but 
instead uses a hand-crafted non-recursive Makefile that requires gnu make. If you're really interested, please read the 
comments m the top-level Makefile. 
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Chapter 3. Running OPDF 

This chapter describes how to run the qpdf program from the command line. 

3.1. Basic Invocation 


When running qpdf, the basic invocation is as follows: 


qpdf [ options ] infilename [ outfilename ] 


This converts PDF file infileiiame to PDF file outfilename The output file is functionally identical to the mput file but 
may have been structurally reorganized. Also, orphaned objects will be removed from the file. Many transformations 
are available as controlled by the options below. In place of infilename, the parameter —empty may be specified. This 
causes qpdf to use a dummy input file that contains zero pages. The only normal use case for using --empty would be if 
you were going to add pages from another source, as discussed in Section 3.4. ‘'Page Selection Options”, page 8. 

if ©filename appears anywhere in the command-line, it will be read line by line, and each line will be treated as 
a command line argument. The @- option allows arguments to be read from standard input. This allows qpdi to be 
invoked with an arbitrary number of arbitrarily long arguments. It is also very useful for avoiding having to pass 
passwords on the command line. 

outfilename does not have to be seekable. even when generating linearized files. Specify ing as outfilr name means 
to write to standard output. However, you can’t specify the same file as both the input and the output because qpdf reads 
data from the input file as it writes to the output file. QPDF attempts to detect this case and fail without overwriting 
the output file. 

Most options require an output file, but some testing or inspection commands do not. These are specifically noted. 

3.2. Basic Options 

The following options are the most common ones and perform commonly needed transformations. 

--password=password 

Specifies a password for accessing encrypted files. 

-verbose 

Increase verbosity of output. For now, this just prints some indication of any file that it creates. 


—linearize 


Causes generation of a linearized (w r eb-optimized) output file. 

■copy-encry ption=file 

Encrypt the file using the same encryption parameters, including user and owner password, as the specified file. 
Use -encrypt-file-password to specify a password if one is needed to open this file. Note that copying the 
encryption parameters from a file also copies the first half of / ID from the file since this is part of the encryption 
parameters. 

encrypt-file-pa ss w or d=passw ord 

If the file specified with -copy-encryption requires a password, specify the password using this option. Note 
that only one of the user or owner password is required. Both passwords will be preserved since QPDF does 
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not distinguish between the two passwords. It is possible to preserve encryption parameters, including the owner 
password, from a file even if you don t know the file's owner password. 

--encrypt options -- 

Causes generation an encrypted output file. Please see Section 3.3, "Encryption Options", page 6 for details 
on how to specify encryption parameters. 

-decrypt 

Removes any encryption on the file. A password must be supplied if the file is password protected. 

-rotate-l+i-]angle :page-rangc 

Apply rotation to specified pages. The page-range portion of the option value has the same format as page ranges 
in Section 3.4, “Page Selection Options", page 8. The angle portion of the parameter may be either 90, 180, or 
270. If preceded by + or -. the angle is added to or subtracted from the specified pages' original rotations. Otherw ise 
the pages' rotations are set to the exact value. For example, the command qpdf in.pdf out.pdf —rotate=+90:2,4,6 
—rotate= 180:7-8 would rotate pages 2, 4, and 6 90 degrees clockwise from their original rotation and force the 
rotation of pages 7 through 9 to 180 degrees regardless of their original rotation. 


pages options 


Select specific pages from one or more input files. See Section 3.4, “Page Selection Options”, page 8 for 
details on how to do page selection (splitting and merging). 

-split-pages=[ii] 


Write each group of n pages to a separate output file. If n is not specified, create single pages. Output file names 
are generated as follows: 

• If the string %d appears in the output file name, it is replaced with a range of zero-padded page numbers starting 
from 1. 

• Otherwise, if the output file name ends in .pdf (case insensitive), a zero-padded page range, preceded by a dash, 
is inserted before the file extension. 

• Otherwise, the file name is appended with a zero-padded page range preceded by a dash. 

Page ranges are a single number in the case of single-page groups or two numbers separated by a dash otherwise. 
For example, if infile.pdf has 12 pages 

• qpdf -split-pages infile.pdf %d-out would generate files 01-out through 12-out 

• qpdf — split-pages=2 infile.pdf outfi)e.pdf would generate files outftle-01-02.pdf through outfile-11- I2.pdf 

• qpdf-split-pages infile.pdf something.else would generate files something.clse-01 through sornething.else-12 

Note that outlines, threads, and other global features of the original PDF file are not preserved. For each page 
of output, this option creates an empty PDF and copies a single page from the output into it. If you require the 
global data, you will have to run qpdf with the -pages option once for each file. Using -split-pages is much 
faster if you don't require the global data. 

Password-protected files may be opened by specifying a password. By default, qpdf will preserve any encry ption data 
associated with a file. If —decrypt is specified, qpdf will attempt to remove any encryption information. If —encrypt 
is specified, qpdf will replace the document's encryption parameters with whatever is specified. 
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Note that qpdt does not obey encryption restrictions already imposed on the file. Doing so would be meaningless since 
qpdf can be used to remove encryption from the file entirely. This functionality is not intended to be used for bypassing 
copyright restrictions or other restrictions placed on files by their producers. 

In all cases where qpdf allows specification of a password, care must be taken if the password contains characters 
that fall outside of the 7-bit US-ASCII character range to ensure that the exact correct byte sequence is provided. It 
is possible that a future version of qpdf may handle this more gracefully. For example, if a password was encrypted 
using a password that was encoded in ISO-8859-1 and your terminal is configured to use UTF-8, the password you 
supply may not work properly. There are various approaches to handling this. For example, if you are using Linux 
and have the iconv executable installed, you could pass -passwords'echo password I iconv -t iso-8859-1 ' to qpdt 
where password is a password specified in youi terminal's locale. A detailed discussion of this is out of scope for 
this manual, but just be aware of this issue if you have trouble with a password that contains 8-bit characters. 

3.3. Encryption Options 

To change the encryption parameters of a file, use the -encrypt flag. The syntax is 


—encrypt user-password owner-password key-lenqth [ restrictions ] — 


Note that ” terminates parsing of encryption flags and must be present even if no restrictions are present. 

Either or both of the user password and the owner password may be empty strings. 

The value for key-lengt h may be 40, 128, or 25b The restriction flags are dependent upon key length. When no 
additional restrictions are given, the default is to be fully permissive. 

If key-length is 40, the following restriction options are available: 

-pi int=[yn| 


Determines whether or not to allow printing. 


-modify=[ynJ 


Determines whether or not to allow document modification. 

—extract=[yn] 

Determines whether or not to allow text/image extraction. 

~annotate=[yn] 

Determines whether or not to allow comments and form fill-in and signing. 
If key-length is 128, the following restriction options are available: 

—accessibility^!} n] 

Determine* 3 whether or not to allow accessibility to visually impaired. 

—extract=[yn] 

Determines whether or not to allow text/graphic extraction. 

~print=prin t -opt 

Controls printing access, print-opt may be one of the following: 
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• Full allow lull printing 

• low: allow low-resolution printing only 

• none: disallow printing 

-modify=modi fy-opt 

Controls modify access, modi fy-opt may be one of the following, each of which implies all the options that 
follow it: 

• all: allow full document modification 

• annotate: allow comment authoring and form operations 

• form: allow form field fill-in and signing 

• assembly: allow documenl assembly only 

• none allow no modifications 
-cleartext-metadata 

If specified, any metadata stream in the document will be left unencrypted even if the rest of the document is 
encrypted. This also forces the PDF version to be at least 1.5. 

-use-aes=[} n] 

If --use-aes=y is specified, AES encryption will be used instead of RC4 encryption. This forces the PDF version 
to be at least 1.6. 

-force-V4 


Use of this option forces the /V and /R parameters in the document's encryption dictionary to be set to the value 
4. As qpdf will automatically do this wfien required, there is no reason to ever use this option. It exists primarily 
lor use in testing qpdf itself. This option also forces the PDF version to be at least 1.5. 

If key-length is 256, the mini mum PDF version is 1.7 with extension level 8, and the AES -based encryption format 
used is the PDF 2.0 encryption method supported by Acrobat X. the same options are available as with 128 bits wuh 
the following exceptions: 


use-acs 


This option is not available with 256-bit keys. AES is always used with 256-bit encryption keys. 


—force-V4 


This option is not av ailable with 256 keys. 

—force-R5 

If specified, qpdf sets the minimum version to 1,7 at extension level 3 and writes the deprecated encryption format 
used by Acrobat version IX. This option should not be used in practice to generate PDF files that will be in general 
use, but it can be useful to generate files if you are trying to test proper support in another application for PDF 
files encrypted in this way. 

The default for each permission option is to be fully permissive. 
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3.4. Page Selection Options 

Starting with qpdf 3.0, it is possible to split and merge PDF files by selecting pages from one or more input files. 
Whatever file is given as the primary input file is used as the starting point , but its pages are replaced with pages as 
specified. 


—pages input-file [ — password=password ] [ page-range ] [ ... ] — 


Multiple input files may be specified. Each one is given as the name of the input file, an optional password (if required 
to open the file), and the range of pages. Note that terminates parsing of page selection flags. 

For each file that pages should be taken from, specify the file, a password needed to open the file (if any), and a page 
range. The password needs to be given only once per file. If any of the input files are the same as the primary input 
file or the file used to copy encryption parameters (if specified), you do not need to repeat the password here. The 
same file can be repeated multiple times. If a file that is repeated has a password, the password only has to be given 
the first time. All non-page data (info, outlines, page numbers, etc.) are taken from the primal y input file. To discard 
these, use --empty as the primary input. 

Starting with qpdf 5.0.0. it is possible to omit the page range. If qpdt sees a value in the place where it expects a page 
range and that value is not a valid range but is a valid file name, qpdf will implk ltiy use the range 1-z, meaning that 
it will include all pages in the file. This makes it possible to easily combine all pages in a set of files with a command 
like qpdf -empty out.pdf -pages *.pdf --. 

It is not presently possible to specify the same page from the same file directly more than once, but you can make this 
work by specifying two different paths to the same file (such as by putting ./somewhere in the path). This can also be 
used if you w ani to repeal a page from one of the mput files in the output file. This may be mane more convenient in 
a future version of qpdf if there is enough demand for this feature. 

The page range is a set of numbers separated by commas, ranges of numbers separated dashes, or combinations of 
those. The character “z” represents the last page. Pages can appear in any order. Ranges can apnea- with a high number 
followed by a low number, which causes the pages to appear in reverse Repeating a number will cause an error, but 
you can use the workaround discussed above should you really want to include the same page twice. 

Example page ranges: 

• 1,3, 5-9,15-12: pages l, 3, 5, 6, 7, 8, 9, 15, 14, 13, and 12in that order. 

• z -1: all pages in the document in reverse 

Note that qpdt doesn't presently do anything special about other constructs in a PDF tile that may know about pages, 
so semantics of splitting and merging vary, across features. For example, the document's outlines (boukmarks) point 
to actual page objects, so if you select some pages and not others, bookmarks that point to pages (hat are in the output 
file will work, and remaining bookmarks will not work. On the other hand, page labels (page numbers specified in tne 
file) are just sequential, so page labels will be messed up in the output file. A future version of qpdf may do a better 
job at handling these issues. (Note that the qpaf library already contains all of the APIs required in order to implement 
this in your own application if you need it.) In the mean time, you can always use —empty as the primary input file to 
avoid copying all of that from the first file For example, to take pages 1 through 5 from a infile.pdf while preserving 
all metadata associated with that file, you could use 


qpdf infile.pdf —pages infile.pdf 1—5 — outfile.pdf 


If you wanted pages 1 through 5 from infile pdf but you wanted the rest of the metadata to be dropped, you could 
instead run 
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qpdf - enpt y -pages infile.pdf 1 5 -- outfile.pdf 


If you wanted to take pages 1-5 from filel.pdf and pages 11-15 fromfile2.pdf in reverse, you would run 


qpdf filel.pdf --pages filel.pdf 1-5 fi 1 e2 pdf 15-11 -- outfile.pdf 


If, for some reason, you wanted to take the first page ot an encrypted file called encrypted.pdf wich password pas s 
and repeat it twice in an output file, and if you wanted to drop metadata (like page numbers and outlines) but preserve 
encrj ption, you would use 


qpdf —enpty —copy-e ncr ypi i on=encr ypt ed .pd f —cticr ypi i on-fiil e-pas s wnr d=pas s 
--pages encrypted pdf —pa s s wor d=pa s s 1 . /oner ypi ed .pdf —pa s s wor d=pa s s 1 — 
out fi 1 e .pdf 


Note ihat we had to specify the password all three times because giving a password as --encryption-file-password 
doesn't count for page selection, and as far as qpdf is concerned, erurypredpdf and ./encrypted.pdf are separated files. 
These are all comer cases that most users should hopefully never have to be bothered with. 

3.5. Advanced Transformation Options 

These transformation options control fine points of how qpdf cre ates the output file. Mostly these are of use only to 
people who are very lamiliar with the PDF file formal or who are PDF developers. The following options are available: 

--compress-streams^ [yn ] 

By default, or with — compress-streams=y, qpdf will compress any stream with no other filters applied to it with 
the /FlateDecode filter when it writes it. To suppress this behavior and preserve uncompressed streams as 
uncompressed, use ^-compri ss streams-n 

--decode-le vel= option 

Controls which streams qpdf tries to decode. The default is generalized. The following options are available: 

• none: do not attempt to decode any streams 

• generalized: decode streams filtered with supported generalized filters: /LZWDerode /FlateDecode, / 
ASCII85Decode, and /ASCUHexDecode. We define generalized filters as those to be used for general-pur¬ 
pose compression or encoding, as opposed to filters specifically designed for image data. 

• specialized: in addition to generalized, decode streams with supported non-lossy specialized filters; currently 
this is just /RunLengihDecode 

• all. in addition to generalized and specialized- decode streams with supported lossy filters, currently this is just 
/DCTDecode (JPEG) 

-stream-data =option 

Controls transformation of stream data. This option predates the --compress-streams and —decode-lev el options. 
Those options can be used to achieve the same affect with more control. The value of option may be one of 
die following: 

• compress: recompress stream data when possible (default); equivalent to ~compress-streams=y - -det ode-lev - 
el=generalized 

• preserve leave all stream data as is; equivalent to --compress-streams=n -decode-level=none 
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• uncompress; uncompress stream data compressed with generalized filters when possible: equivalent to -com- 
press-streams=n -decode-lev el=generalized 

-normalize content=Lyn] 

Enables or disables normalization of content streams. 

-suppress-recovery 

Prevents qpdf from attempting to recover damaged tiles. 

-object-streams=jnode 

Controls handling of object streams. The value of mode may be one of the following: 

• preserve: preserve original object streams f default) 

• disable don't write any object streams 

• generate use object streams wherever possible 

-ignore-xref-streams 

Tells qpdl to ignore any cross- reference streams. 

-preserve-unreferenced 

Tells qpdf to preserve objects thal are not referenced when writing the file. Ordinarily any object that is not 
referenced in a traversal of the document from the trailer dictionary will be discarded. This may be useful in 
working with some damaged files or inspecting files with known unreferenced objects. 

This flag is ignored for linearized files and has the effect of causing objects in the new file to be written in ordei 
by object ID from the original file, This does not mean that object numbers will be the same since qpdf may 
create stream lengths as direct or indirect differently from the original file, and the original file may have gaps 
in its numbering. 

-newline-before-endstream 

Tells qpdi to insert a new line before the endst ream keyword, not counted in the length, after any stream content 
even it' the last character of the stream was a newline Tins may result in two newlines in some cases. This is 
a requirement of PDF/A. While qpdf doesn't specifically know how to generate PDF/A-compliant PDFs, this at 
least prevents it from removing compliance on already compliant files. 

—qdi 

Turns on QDF mode For additional information on QDF, please see Chapter 4, QDF Mock, page 14. 


—min-v ersion=version 


Forces the PDF version of the output file to be at least version. In other words, if the input file has a lower 
version than the specified version, the specified version will be used. If the input file has a higher version, the 
input file’s original version will be used It is seldom necessary to use this option smee qpdf w ill automatically 
increase the version as needed when adding features that require newer PDF readers. 

The version number may be expressed in the form major .minor . extension-level, in which case the 
version is interpreted as ma jor .minor at extension level extension-level. For example, version 1.7.8 
represents version 1.7 at extension level 8 Note that minimal syntax checking is done on the command line. 
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—force-v ersion =version 

This; option forces the PDF version to be the exact version specified even when the file may have content that 
is not supported in that version The version number is interpreted in the same way as with — min-version so 
that extension let els can be set. In some cases, forcing the output file's PDF version to be lower man that of the 
input file will cause qpdf to disable certain features of the document. Specifically. 256-bit keys are disabled if 
the version is less than 1.7 with extension level 8 (except R5 is disabled if less than L.7 with extension level 3), 
AES encryption is disabled if the version is less than 1.6, cleartext metadata and object streams are disabled if less 
than 1.5, 128-bit encryption keys are disabled if less than 1.4, and all encryption is disabled if less than 1.3. Even 
with these precautions, qpdf won't be able to do things like eliminate use of newer image compression schemes, 
transparency groups, or other features that may have been added in more recent versions of PDF. 

As a general rule, with the exception of big structural things like the use of object streams or AES encryption, 
PDF viewers are supposed to ignoie features in files that they don't support from newer versions. This means that 
forcing the version to a lower version may make it possible to open your PDF file with an older version, though 
bear in mind that some of the original document's functionality may be lost. 

By default, when a stream is encoded Using non-lossy filters that qpdl understands «nd is not already compressed 
using a good compression scheme, qpdf will uncompress and recompress streams. Assuming proper filter implements, 
this is safe and generally results in smaller files. This behavior may also be explicitly requested with -- stream-da¬ 
ta =compress. 

When — normalize-content=y is specified qpdl will attempt to normalize whitespace and newlines in page content 
streams. This is generally safe but could, in some cases, cause damage to the content streams. This option is intended 
for people who wish to study PDF content streams or to debug PDF content. You should not use this for “production” 
PDF files. 

Ordinarily, qpdf will attempt to recover from certain ty pes of errors ir PDF files. These include errors in me cross- 
reference table, certain types of object numbering errors, and certain types of stream length errors. Sometimes, qpdf 
may think it has recovered but may not have actually recovered, so care should be taken when using this option as 
some data loss is possible. The -suppress-recovery option will prevent qpdf from attempting recovery. In this case, 
it will fail on the first error that it encounters. 

Object streams, also known as compressed objects, were introduced into the PDF specification at version 1.5, coi re¬ 
sponding to Acrobat 6. Some older PDF viewers may not support tiles with object streams, qpdf can be used to trans¬ 
form files with object streams to files without object streams or vice versa. As mentioned above, there are three object 
stream modes: preserve disable, and generate. 

In preserve mode, the relationship to objects and the streams that contain them is preserved from the original file. In 
disable mode all objects are wi itten as regular, uncompressed objects. The resulting file should be readable by older 
PDF viewers. (Of course, the content of the files may include features not supported by older viewers, but at least 
the structure will be supported.i In generate mode, qpdf will create its own object streams. This will usually result m 
more compact PDF files, though they may not be readable by older viewers. In this mode, qpdf will also make sure 
the PDF version number in the header is at least 1.5. 

Ordinarily. 4 pdf reads cross-reference streams when they' are present in a PDF file If --ignore- xref-streams is spec¬ 
ified, qpdf will ignore any cross-reference streams for hybrid PDF files. The purpose of hybrid files is to make some 
content available to viewers that are not aware of cross-reference streams. It is almost never desirahle to ignore them. 
The only time when you might want to use this feature is if you are testing creation of hybrid PDF files and wish to 
see how a PDF consumer that doesn't understand object and cross-reference streams would interpret such a file. 

The — qdf flag turns on QDF mode, which changes some of the defaults described above. Specifically, in QDF mode, 
by default, stream data is uncompressed, content streams are normalized, and encryption is removed. These defaults 
can still be overridden by specifying the appropriate options as described above. Additionally, in QDF mode, stream 
lengths are stored as indirect objects, objects are laid out in a less efficient bur more readable fashion, and the documents 
are interspersed with comments that make it easier for the user to find things and also make it possible for fix-qdf to 
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work properly QDF mode is intended for people, mostly developers, who wish to inspect or modify PDF files in a 
text editor. For details, please see Chapter 4, QDF Mode, page 14. 

3.6. Testing, Inspection, and Debugging Op¬ 
tions 


These options can be useful for digging into PDF fi les or for use in automated test suites for software that uses the qpdf 
library. When any of the options in this section are specified, no output file should be given. The following options 
are available: 


-deterministic-id 


Causes generation of a deterministic value for /ED, This prevents use of timestamp and output file name informa¬ 
tion in the /ID generation. Instead, at some slight additional runtime cost, the /ID field is generated to include a 
digest of the significant parts of the content of the outpul PDF file. This means that a given qpdf operation should 
generate the same /ID each time it is run. which can be useful when caching results or for generation of some test 
data. Use of this flag is not compatible with creation of encrypted files. 

static-id 


Causes generation of a fixed value for /ID. This is intended for testing only. Never use it for production files. If 
you are trying to get the same /ID each time for a given file and you are not generadng encrypted files, consider 

using the -deterministic-id option. 


■static-aes-iv 


Causes use of a static initialization vector for AES-CBC. This is intended for testing only so that output files 
can be reproducible. Never use it for production files. This option in particular is not secure since it significantly 
weakens the encry ption. 


no-original-object-ids 


Suppresses inclusion of original object ID comments m QDF files. This can be useful when generating QDF files 
for test purposes, particularly when comparing them to determine whether two PDF files have identical content. 

—show-encryption 

Shows document encryption parameters. Also shows the document's user password if the owner password is given. 

-check-linearization 

Checks file integrity and linearization status. 

-show-linearization 


Checks and displays all data in the linearization hint tables. 

—show-xref 

Shows the contents of the cross-reference table in a human-readable form. This is especially useful for files with 
cross-reference streams which are stored in a binary format. 

—show-object=obj'[,gen] 

Show the contents of the given object. This is especially useful tor inspecting objects that are inside of object 
streams (also known as ‘ compressed objects”). 
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--raw-st ream-data 

When used along with the --show-object opuon, if the object is a stream, shows the raw stream data instead of 
object's contents. 

-filtered-stream-data 

When used along with the —show -object option, it the object is a stream, shows the filtered stream data instead 
of object's contents. If the stream is filtered using filters that qpdf does not support, an error will be issued. 

~show-npag< s 

Prints the number of pages in the input file on a line by itself. Since the number of pages appears by itself on a 
line, this opuon can be useful for scripting if you need to know the number of pages in a file. 

-show -pages 

Shows the object and generation number tor eacn page dictionary object and for each content stieam associated 
with the page. Having this information makes it more convenient to inspect objects from a particular page 


-with-images 


When used along with -show-pages, also shows the object and generation numbers for the image objects on each 
page. (At present, information about images in shared resource dictionaries are not output by this command. This 
is discussed in a comment in the source code.) 


cheek 


Checks file structure and well as encryption, linearization, and encoding of stream data. A file for which -check 
reports no errors may still have errors in stream data content but should otherwise be structurally sound. If -check 
any errors, qpdf will exil with a status of 2. There are some recoverable conditions that -check detects. These 
are issued as warnings instead of errors. If qpdf finds no errors but finds warnings, it will exit with a status of 
3 (as of version 2.0,4). When —check is combmed with other opuons checks are always perfoi med before any 
other options are processed. For erroneous files, -check will cause qpdf to attempt to recover, after which otnei 
options are effectively operating on the recovered file. Combining -check with other notions in this way can be 
useful for manually recovering severely damaged files. 

The -raw-stream-data and — filtered stream-data options are ignored unless -show-object is given. Either of these 
options will cause the stream data to be written to standard output In order to avoid commingling of stream data with 
other output, it is recommend that these objects not be combined with other test/inspection options. 

If — filtered-stream-data is given and — normalize-content-y is also given, qpdf will attempt to normalize the stieam 
data as if it is a page content stream. This attempt will be made even if it is not a page content stieam, in whLh case 
it will produce unusable results. 
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Chapter 4. QDF Mode 

In QDF mode, qpdf creates PDF files in what we call QDF form. A PDF file in QDF form, sometimes ca 1 led a QDF 
file, is a completely valid PDF file that has %QDF-1.0 as its third lme (after the pdf header and binary characters) 
and has certain other characteristics. The purpose of QDF form is to make it possible to edil PDF files, with some 
restrictions, in an ordinary text editor. This can be very useful for experimenting with different PDF constructs or for 
making one-ofl edits to PDF files (though there are other reasons why this may not always work). 

It is ordinarily very difficult to edit PDF files in a text editor for two reasons: most meaningful data in PDF files is 
compressed, and PDF files are full of offset and length information that makes it hard to add or remove data. A QDF 
file is organized in a manner such that, if edits are kept within certain constraints, the fix-qdf program, distributed with 
qpdf is able to restore edited files to a correct state. The fix- qdf program takes no command-line arguments. It re ads 
a possibly edited QDF file from standard input and writes a repaired file to standard output. 

The following attributes characterize a QDF file: 

• AH objects appear in numerical order in the PDF file, including when objects appeal in object streams. 

• Objects are printed in an easy-to-iead format, and all line endings are normalized to UNIX line endings. 

• Unless specifically oven idden, streams appear uncompressed (when qpdf supports the filters and they are com¬ 
pressed with anon-lossy compression scheme), and most content streams are normalized (line endings are converted 
to just a UNIX-style linefeeds). 

• All streams lengths are represented as indirect objects, and the stream length object is always the: next object after 
the stream. If the stream data does not end with a newline, an extra newline is inserted, and a special comment 
appears alter the stream indicating that this has been done. 

• If the PDF file contains object streams, if object stream n contains k objects, those objects are numbered from n 
+J through n+k. and the object number/offset pairs appear on a separate fine for each object. Additionally, each 
object in the object stream is preceded by a comment indicating its object number and index. This makes it very 
easy to find objects in object streams. 

• A'l beginnings of objects, stream tokens, endst ream tokens, andendob j tokens appear on fines by themselves. 
A blank line follows every endob j token. 

• If there is a cross-reference stream, it is unfiltered. 

• Page dictionaries and page content streams are marked with special comments that make them easy to find. 

• Comments precede each object indicating the object number of the corresponding object in the original file 

When editing a QDF file, any edits can be made as long as the above constraints are maintained This means that you 
can treely edit a page's content without worrying about messing up the QDF file It is also possible to add new objects 
so long as those objects are added after the fast object in the file or subsequent objects are renumbered. If a QDF file 
has object stream* in it, you can always add the new objects before the xref stream and then change the number of the 
xref stream, since nothing generally ever references it by number. 

It is not generally practical to remove objects from QDF files without messing up object numbering, but if you remove 
all references to an object, you can run qpdf on the file (after running fix-qdf), and qpdf will omit the now-orphaned 
object. 

When fix-qdf is run, it goes through the file and recomputes the follow ing parts of the file: 

« the /N, /W, and /First keys of all object stream dictionaries 
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• the pairs of numbers representing object numbers and offsets of objects in objec' streams 

• all stream lengths 

• the cross-reference table or cross-reference stream 

• the offset to the cross-reference table or cross-reference stream following the startxref token 
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Chapter 5. Using the QPDF Library 

The source tree for the qpdf package has an examples directory that contains a few example programs. The qpdi/ 
qpdf.ee source file also serves as a useful example since it exercises almost all of the qpdf library's public interface. 
The best source of documentation on the library itself Is reading comments in iaclvide/qpd&QPDF.hh, mc\ude/qpdfZ 
QPDFWriterhh, and me\ude/qpd&QPDFOb)ecXHand\e.hh. 

All header files are installed in the include/apdt directory. It is recommend that you use # include <qpdf/ 
QPDF . hh> rather than adding includc/qpdf to your include path. 

When linling against the qpdf static library, you may also need to specify -lz -1 jpeg on you 1- link command If 
your system understands how to read libtool .la files, this may not be neeessaiy. 

The qpdf library is safe to use in a multithreaded program, but no individual QPDF object instance (including QPDF, 
QPDFObjectHandle, or QPDFWr j ter) can be used in more than one thread at a time. Multiple threads may 
simultaneously work with different instances of these and ill other QPDF objects. 
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Chapter 6. Design and Library Notes 

6.1. Introduction 


This section was written prior to the implementation of the qpdf package and was subsequently modified to reflect the 
implementation. In some cases, for purposes of explanation, it may differ slighrly from the actual implementation. As 
always, the source code and test suite are authoritative. Even if there are some errors, thus document should serve as 
a road map to understanding how this code works. 

In general one should adhere strictly to a specification when writing bui be liberal in reading This way, the product 
of our software will be accepted by the widest range of other programs, and we will accept the widest range of input 
files. This library attempts to conform to that philosophy whenever possible but also aims to provide strict checking 
for people who want to validate PDF files. If you don't want to see warnings and are trying to write something that 
is toleiani, you can call setSuppressWarnings (true ). If you want to fail on the first error, you can call se- 
tAttemptRecovery (false) , The default behavior is to generating warnings for recoverable problems. Note that 
recovery will not always produce the desired results even if it is able to gel through the file. Unlike most other PDF 
files that produce generic warnings such as “This file is damaged,'’, qpdf generally issues a detailed error message that 
would be most useful to a PDF developer. This is by design as them seems to be a shortage of PDF validation tools 
out there. (This was, in fact, one of the major motivations behind the initial creation of qpdf.) 

6.2. Design Goals 

The QPDF package includes support for reading and rewriting PDF files It aims to hide from the user details involving 
object locations, modified (appended) PDF files, the directness/indirectness of objects, and stream filters including 
encry ption. It does not aim to hide knowledge of the object hierarchy or content stream contents. Put mother way. a 
user of the qpdf library is expected to have knowledge about how PDF files work, but is not expected to have to keep 
track of bookkeeping details such as file positions. 

A user of the library never has to care whether an object is direct or indirect. All access to objects deals with this 
transparently. All memory management details are also handled by the library, 

Th PolflterHolder object is used internally by the library to deal with memory management. This is basically a 
smart pointer object very similar in spirit to the Boost library 's shared_ptr object, bui predating it by several years. 
This library also makes use of a technique for giving fine-girined access to methods in one class to other classes by 
using public subclasses with friends and only private members that in turn call private methods of the containing class. 

See QPDFObjectHandle: :Factory as an example 

The top-level qpdf class is QPDF A QPDF object represents a PDF file. The library provides methods for both 
accessing and mutaung PDF files. 

QPDFObject is the basic FDF Object class. It is an abstract base class from whir hare derived classes for eachtype 
ot PDF object. Clients do not interact with Objects directly but instead interact w ith QPDFObjectHandle 

QPDFObjectHandle contains PomterHoldet<QPDFObjecl> md includes accessor methods that are type-safe 
proxies to the methods of the derived object classes as well as methods for querying object types. They can be passed 
around by value copied, stored in containers, etc with very low overhead. Instances of QPDFObjectHandle always 
contain a reference back to the QPDFobject from which they were created. A QPDFObjectHandle may be direct 
or indiret t. If indirect, the QPDFObjeci the Poinmf Holder initially points to is a null pointer. In this case, the 
first attempt to access the underlying QPDFObject will result in the QPDFObject being resolved via a call to the 
referenced QPDF instance. This makes it essenually impossible fo make coding errors in which certain things will 
work for some PDF files and not for others based on which objects are direct and which objects are indirect. 
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Instances of QPDFObjectHandle can be directly created and modified using static factor}’ methods in the QPDFOb- 
jectHandle class. There are factory methods for each type of object as well as a convenience method QPDFObjec¬ 
tHandle: -.parse that creares an object from a siring representation of the object Existing instances of QPDFObjec- 
tHandle can also be modified in several ways. See comments in QPDFObjectHandle.hh for details. 

When the QPDFc lass creates a new object, it dynamically allocates tne appropriate type of QPDFObject and im¬ 
mediately hands the pointer to an instance of QPDFObjectHandle. The parser reads a token from the current tile 
position. If the token is a not either a dictionary or array opener, an object is immediately constructed from the single 
token and the parser returns. Otherwise, the parser is invoked recursively in a special mode in which it accumulates 
objects until it finds a balancing closer. Dunng this process, the “R” keyword is recognized and an indirect QPDFOb¬ 
jectHandle may be constructed. 

The QPDF::resolve() method, which is used to resolve an indirect object, may be invoked from the QPDFObjec¬ 
tHandle class. It first checks a cache to see whether this object has already been read. If not, it reads the object from 
the PDF file and caches it. It the returns the resulting QPDFObiectHandle. Tb calling object handle then replaces 
its PointerHolder<QDFObiect> with me one from me newly returned QPDFObjeciHa.idle In this way. only a 
single copy of any direct object need exist and clients can access objects transparently without knowing caring whether 
they are direct or indirect objects. Additionally , no object is ever read from the file more than once. That means that 
only the portions of the PDF file that are ac tually needed are ever read from the input file, thus allowing the qpdf 
package to take advantage of this important design goal of PDF files. 

If the requested object is inside of an object stream, the object stream itself is firslread into memory. Thn the tokenizer 
reads objects from the memca y stream based on the offset information stored in the stream. Tbse individual objects 
are cached, after w hit h the temporary buffer holding the object stream contents are discarded. In this way, the first 
time an object in an object stream is requested all objects in the stream are cached. 

An instance of QPDF is constructed by using the class's default constructor. If desired, the QPDF object may be 
configured with various methods that change its default behavior. Tlan the QPDF::processFile() method is passed 
the name of a PDF file, which permanently associates the file with that QPDF object. A password may also be given 
for access to password-protected files. QPDF does not enforce encry ption parameters and will treat user and owner 
passwords equivalently. Either password may be used to access an tnci ypted file. QPDF will allow recovery of a 
user password given an owner password. The input PDF file must be seekable. (Output files written by QPDFWrlter 
need not be seekable, even when creating Linearized files.) During construction, QPDF validates the PDF file's header, 
and ihen reads the cross reference tables and trader dictionaries, rhe QPDF class keeps only the first jailer dicuonary 
though it does read all of them so it can check the /Prev key. QPDF class users may request the root object and 
the trailer dictionary specifically. The cross reference table is kept private. Objects may then be requested by number 
of by walking the object tree. 

When a PDF file has a cross-reference stream instead of a cross-reference table and trailer, requesting the document's 
trailer dictionary returns the stream dictionary from the cross-reference stream instead. 

Tlaie are some convenience routines for very common operations such as wal king the page tree and returning a vector 
of all page objects. For full details, please see the header file QPDF.hh. 

fhe following example should claiify how QPDF processes a simple file. 

• Client constructs QPDF pdf and calls pdf.processFile(”a.pdf');. 

• The QPDF class checks the beginning of a.pdffor % ! PDF-1 . [ C - 9] +. It then reads the cross reference table 
mentioned at the end of the file, ensuring that it is looking before the last %%EOF. After getting to trailer 
keyword, it invokes the parser 

1 As pointed out earlier, the intention is not for qpof to be used to bypass security on files, bin as any open source PDF consumer maj be easilj 
modified to bypass basic PDF document security, and qpdf offers maj transformations that can do this as well, there seems to be little point in the 
added comnlexity of conditionally enforcing document security. 
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• The parser sees "«”, so it calls itself recursively in dictionary creation mode. 

• In dictionary creation mode, the parser keeps accumulating objects until il encounters Each object that is 
read is pushed onto a stack. If “R” is read, the last two objects on the stack are inspected. If the;, are integers, 
they are popped off the stack and their values are used to construct an indirect object handle which is then pushed 
onto the stack. When “>>” is finally read, the stack is converted into a QPDF_DlCtlonary which is placed in a 

QPDFObjectHandle and returned. 

« The resulting dictionary is saved as the trailer dictionary. 

• The /Prev key is searched. If present, QPDF seeks to that point and repeats except that the new trailer dictionary 
is not saved. If /Prev is not present, the initial parsing process is complete. 

If there is an encryption dictionary, the document’s encryption parameters are initialized. 

• The client request 5 root object. The OPDF class gets the value of root key hum trailer dictionary and returns it. It 
is an unresolved indirect QPDFObjectHandle. 

• The client requests the /Pages key from root QPDFObjectHandle. The QPDFObjectHandle notices that it 
is indirect so it asks QPDF to resolve it. QPDF looks in the object cache for an object with the root dictionary's 
object ID and generation number. Upon not seemg it, it checks the cross reference table, gets the offset, and reads 
the object present at that offset It stores the result in the object cache and returns the cac hed result. The calling 
QPDFObjectHandle replaces its object pointer with the one from the resolved QPDFObjectHandle. verities 
that it a valid dictionary object, and returns the (unresolved indirect) QPDFObject handle to the top of the Pages 
hierarchy. 

As the client continues to request objects, the same process is followed for each new requested object. 

6.3. Casting Policy 

This section describes the casting policy followed by qpd T ’s implementation This is no concern to qpdfs end users 
and largely of no concern to people writing code that uses qodl, but it could be of interest to people who are porting 
qpdf to a new platform oi who are making modifications to the code. 

The C++ code in qpdf is free of old-style casts excepi where unavoidable (e.g where the old-style cast is in a macro 
provided by a third-party header file). When there is a need for a cast, it is handled, in order of preference, by rewriting 
the code to avoid the need for a cast, calling const_cast. calling static_cast. calling reinterpret_cast, or calling some 
combination of the above. As a last resort, a compiler-specific tpragma may be used to suppress a warning that we 
don’t want to fix. Examples may include suppressing warning* aboul the use of old-style casts in code that is shared 
between C and C++ code. 

The casting policy explicitly prohibits casting between integer sizes for no purpose other than to quiet a compiler 
warning when there is no reasonable chance of a problem resulting. The reason for this exclusion is that the practice 
of adding these additional casts precludes future use of additional compiler warning* as a tool for making future 
improvements to this aspect of the code, and it also damages the readability of the code. 

There are a few significant areas where casting is common in the qpdf sources or where casting would be required to 
quiet higher levels of compiler warnings but is omitted at present: 

• char vs. unsigned char. Eor historical reasons, there are a lot of places in qpdfs internals that deal with 
unsigned char, which means that a lot of casting is required to interoperate with standard library calls and 
std: : string. In retrospect, qp df should have probably used regular (signed) char and char* everywhere and 
just cast to unsigned char when needed, but it's too late to make that change now. There are reintcrpret_cast 
calls to go between char* and unsigned char*, and there are static_cast calls to go between char and 
unsigned cha r. These should always be safe. 
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• Non-const unsigned char* used in the Pipeline interlace. The pipeline intei face has a write call that uses 
unsigned char* without a const qualifier. The main reason for this is to support pipelines that make calls to 
third-party libraries, such as zlib, that don t include const in their interfaces. Unfortunately, there are many places 
in the code where it is desirable to have const char * with pipelines. None of the pipeline implementations in 
qpdf cum ntly modify the data passed to wrue, anu doing so would be counter to the intern of Pipeline, but there 
is nothing in the code to prevent this from being done. There are places in the code where const_cast is used to 
remove the const-ness of pointers going into P ipel rnes. This could theoretically be unsafe, bul there is adequate 
testing to assert that it is safe and will remain safe in qpdl's code. 

« si ze_t vs. qpdf_of f set_t. This is pretty much unavoidable since sizes are unsigned types and offsets are 
signed types. Whenever it is necessary to seek by an amount given by a size_t, it becomes necessary to mix and 
match between s i ze_t and qpdf_of f s et_t. Additionally, qpaf sometimes treats memory buffers like Sles (as 
with Buffer Input Source, and those seek interfaces have to be eonsiatenl with file-based input sources. Neither 
gcc nor MSVC give warnings for this case by default, but both have warning flags that can enable this. (MSVC: 
AVI4267 or /W3, which also enables some additional warnings <hat we ignore; gcc: -Wconversion -Wsign-con¬ 
version;. This could matter for files whose sizes are larger than 2 6: bytes, but it is reasonable to expect that a world 
where such files are common would also have larger size_t and qpdf_of f set_t types in it. On most 64 bit 
systems at the time of this writing (the release of version 4.1.0 of qpdf). both size_t end qpdf_of f set_t are 
64-bit integer types, while on many current 32-bit systems, s i z e_t is a 32-bit type while qpdf_of f set_t is a 
64-bit type. I am not aware of any cases where 32-bit systems that have s i z e_t smaller than qpdf_of f set_t 
could nin into problems. Although I can't conclusively rule out the possibility of such problems existing, 1 suspect 
any cases would be pretty contrived In the event that someone should produce a file that qpdf can't handle because 
of what is suspected to be issues involv ing the handling of size_t vs. qpdf_of f set_t (such files may behave 
properly on 64-bit systems bui not on 32-hit systems because they have very large embedded files or streams, for 
example), the above mentioned w anting 1 lags could be enabled and all those implicit conversions could be carefully 
scrutinized. (I have already gone through that exercise once in adding support for files larger than 4 GB in size.) I 
continue to be committed to supporting large files on 32-bit systems, but I would not go to any lengths to support 
comer cases involving large embedded files or large streams that wort on 64-bit systems but not on 32-bit systems 
because of s i z e_t being coo small. It is reasonable to assume that anyone working with such files would be using 
a 64-bit system anyway since many 32-bit applications would have similar difficulties. 

• size_t vs. int or long. There are some cases where size_t and int or Long or size_t. and unsigned 
i nt or unsigned long are used interchangeably. These cases occur when working with very small amounts of 
memory, such as wirh the bir readers (where we're working with jusia tew byres at a time), some cases of strlen, and 
a few other cases. I have scrutinized all of these cases and determined them to be safe but there is no mechanism in 
the cock to ensure that new unsafe conversions between int and size_t aren’t introduced short of good testing 
and strong awareness of the issues. Again, if any such bugs are suspected in the future, enabling the additional 
warning flags and scrutinizing the warnings would be in order. 

To be clear, I believe qpdf to be well -behaved with respect to sizes and offsets, and qpd*"s test suite includes actual 
generation and full processing of files larger than 4 GB in size. The issues raised here are largely academic and should 
not in any way be interpreted to mean that qodf has practical problems involv ing sloppiness with integer types I also 
believe that appropriate measures have been taken in the code to avoid problems with signed vs. unsigned integers 
from resulting in memory overwrites or other issues with potential security implications, though there are never any 
absolute guarantees. 

6.4. Encryption 

Encryption is supported transparently by qpdf. When opening a PDF file, if an encryption dictionary exists, the QPDF 
object processes this dictionary using the password (if any) provided. The primary decryption key is computed and 
cached. No further access is made to the encryption dictionary after that time. When an object is read from a file, the 
object ID and generation of the object in winch it is contained is always known. Using this information along with 
the stored encryption key, all sire am and string objects are transparently decrypted Raw encrypted objects are never 
stored in memory. This way, nothing in the library ever has to know or care whether it is reading an encrypted file. 
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An interface is also provided for writing encrypted streams and strings given an encryption key. This is used by 
QPDFWrit&r when it rewrites encrypted files. 

When copying encrypted files, unless otherwise directed qpdf w ill preserve any encryption in force in the original 
file, qpdf can do this with either the user or the owner password. There is no difference in capability based on which 
password is used. W hen 40 or 128 bit encryption keys are used, the user password can be recovered with the owner 
password. With 256 keys, the usei and owner passwords are used independently to encry pt the actual encryption key, 
so while either can be used the owner password can no longer be used to recover the user password. 

Starting with version 4.0.0, qpdf can read files that are not encrypted but that contain encrypted attachments, but it 
cannot write such files, qpdf also requires the password to be specified in order to open the file, not just to extract 
attachments, since once the file is open, all decryption is handled transparendy. When copying files like this while 
preserving encryption, qpdf will apply the file's encryption to e\erything in the file, not just to the attachments. When 
decry pting the file, qpdf will decrypt the attachments. In general, when copying PDF files with multiple encryption 
formats, qpdf will choose the newest format. The only exception to this is that dear-text metadata will be preserved 
as clear-text if it is that way in the original file. 

6.5. Random Number Generation 


QPDF generates random numbers to support generation of encrypted data. Versions prior to 5.0.1 used random or rand 
from sldlik to generate random numbers. Version 5.0.1, if available, used operating system-provided secure random 
number generation instead, enabling use of stdlib random number generation only if enabled by a compile-time option. 
Starting in version 5.1.0, use of insecure random numbers was disabled unless enabled at compile time. Starting in 
version 5.1.0, it is also possible for you to disable use of OS-provided secure random numbers. This is especially 
useful on Windows if you want to avoid a dependency on Microsoft's cryptography API. In this case, you must provide 
your own random data prov ider. Regardless of how you compile qpdf. starting in version 5.1.0, it is possible for you 
to provide your own random data provider at runtime. This would enable you to use some software-based secure 
pseudorandom number generator and to avoid use of whatever the operating system provides. For details on how to 
do this, please refer to the top -level RE ADME.md file in the source distribution and to comments in QUtil.hh. 

6.6. Adding and Removing Pages 

While qpdfs API has supported adding and modifying objects for some time, version 3.0 introduces specific methods 
for adding and removing pages. These are largely convenience routines that handle two tncky issues: pushmg inher¬ 
itable resources from the /Pages tree down to individual pages and manipulation of the /Pages tree itself. For 
details, see addPage and surrounding methods in QPDF.hh. 

6.7. Reserving Object Numbers 

Version 3.0 of qpdf introduced the concept of reserved objects, rhese are seldom needed for ordinary operations, but 
there are cases in which you may want to add a series of indirect objects with references to each other to a QPDFobject. 

Tbs causes a problem because you can't determine the object ID that a new indirect object will have until you add it to 
the QPDF object with QPDFr.makelndirectObject. The only way to add two mutually referential objects to a QPDF 
object prior to version 3.0 would be to add the new objects first and then make them refer to each other after adding 
them. Now it is possible to create a reserved object using QPDFObjectHandle::newReserved This is an indirect object 
that stays ■’unresolved"’ even if it is queried for its ty pe. So now. if you want to create a set of mutually referential 
objects, you can create reservations for each one of them and use those reservations to construct the references. When 
finished, you can call QPDF::replaceReserved to replace the reserved objects with the real ones. This functionality 
will never be needed by most applications, but it is used internally by QPDF when copying objects from other PDF 
files, as discussed in Section 6.8, “Copying Objects From Other PDF Files”, page 22. For an example of how to 
use reserved objects, search for newResetved in test_driver.cc in qpdfs sources. 
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6.8. Copying Objects From Other PDF Files 

Version 3.0 of qpdf introduced the ability to copy objects into a QPDF object from a different QPDF object, which 
we refer to an foreign objects. This allows arbitraiy merging of PDF files. The “from” QPDFobject must remain valid 
after the copy as discussed in the note below. The qpdf command-line tool pros ides limited support for basic page 
selection, including merging in pages from other files, but the library's API makes it possible to implement arbitrarily 
complex merging operations. The mam method foi copying foreign objects is QPDF::copyForeignObject. This takes 
an indirect object from another QPDF and copies it recursively into this object while preserving all object structure, 
including circular references. This means you can add a direct objectthat you create from scratch to a QPDFobject with 
QPDF::makelndirectOhject, and you can add an indirect object from another file with QPDF::copyForeignObject. 
The fact that QPDF::makeIndirectObject does not automatically detect a foreign object and copy it is an explicit design 
decision. Copying a foreign object seems like a sufficiently significant thing to do that it should be done explicitly. 

The other way to copy foreign objects is by passing a page from one QPDF to another by calling QPDFr.addPage. 
In contrast to QPDF':. makelndirertObject, this method automatically distinguishes between indirect objects in the 
current file, foreign objects, and direct objects. 

Please note: when you copy objects from one QPDF to another, the source QPDFobject must remain valid until you 
have finished with the destination object. lbs is because the original object is still used to retrieve any referenced 
stream data from the copied object. 

6.9. Writing PDF Files 

The qpdf library supports file writing of QPDFobjecls to PDF files through the QPDFWriter class The QPDFWriter 
class has two wnung modes: one for non-linearized files, and one for linearized files. See Chapter 7, Lineariza¬ 
tion, page 24 for a description of linearization is implemented. This section describes how we write non-linearized 
files including the creation of QDF files (see Chapter 4. QDF Mode, page 14. 

This outline was written prior to implementation and is not exactly accurate, but it provides a correct “notional” idea 
of how writing works. Look at the code in QPDFWriter ror exact details. 

• Initialize state: 

• next object number = 1 

• object queue - empty 

• renumber table: old object id/generation to new id/0 = empty 

• xref table: new id -> offset = empty 

• Create a QPDF object from a file. 

• Write header for new PDF file. 

• Request the trailer dictionary, 

• For each value that is an indirect object, grab the next object number (via an operation that returns and increments 
the number) Map object to new number in renumber table. Push object onto queue. 

• While there are more objects on the queue 

• Pop queue. 

• L ook up object's new number n in the renumbering table. 
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• Srore current otfset into xref table. 

• Writen 0 obj. 

• If object is null, whether direct or indirect, write out null, thus eliminating unresolvable indhect object references. 

• If the object is a stream stream, write sueam contents, piped through any filters as required, to a memory buffer. 
Use this buffer to determine the stream length. 

• If object is not a stream, array, or dictionary, write out its contents. 

• If object is an array or dictionary (including stream), traverse its elements (for array) or values (for dictionaries), 
handling recursive dictionaries and arrays, looking for indirect objects. When an indirect object is found, if it is 
not resolvable, ignore. (This case is handled when wnting it out.) Otherwise, look it up in the renumbenng table 
If not found, grab the next available object number, assign to the referenced object in the renumbering table, and 
push the referenced object onto the queue. As a special case, when writing out a stream dictionary, replace length, 
filters, and decode parameters as required. 

Write out dictionary or array, replacing any unresolvable indirect object references with null (pdf spec says ref¬ 
erence to non-existent object is legal and resolves to null) and any resolvable ones with references to the renum¬ 
bered objects. 

• If the object is a stream, write st ream\n,the stream contents (from the memory buffer), and \nendstream\n. 

• When done, write er.dofc j. 

Once we have finished the queue, all referenced objects will have been written out and all deleted objects or unref¬ 
erenced objects will have been skipped. The new cross-reference table will contain an offset for every new object 
number from 1 up to the number of objects written. This can be used to write out a new xref table. Finally we can 
write out the trailer dictionary with appropriately computed /ID (see spec, 8.3, File Identifiers), the cross reference 
table offset, and %%EOF. 

6.10. Filtered Streams 


Support for streams is implemented through the Pipeline interface which was designed for this package. 

When reading streams, create a series of Pipeline objects. The Pipeline abstract base requires implementation write () 
and finiskf) and provides an implementation of getNextf ). Each pipeline object, upon receiving data, does whatever it 
is going to do and then writes the data (possibly modified) to its successor. Alternatively, a pipeline may be an end- 
of the-line pipeline that does something like store its output to a file or a memory buffer ignoring a successor. For 
additional details, look at Pipeline.hh 

QPDF can read raw or filtered stieams. When reading a filtered sueam, the QPDF class creates a Pipeline objec i for 
one of each appropriate filter object and chains them together The last filter should write to whatever type of output 
is required. The QPDF class has an interface to write raw or filtered stream contents to a given pipeline. 
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Chapter 7. Linearization 

This chapter describes how, QPDF and OPDFWriter implement creation and processing of linearized PDFS. 

7.1. Basic Strategy for Linearization 

To avoid the incestuous problem of having the qpdf library validate its own linearized files, we have a special linearized 
file checking mode which can be invoked via qpdf —check-linearization (or qpdf --check). This mode reads the 
linearization parameter dictionary and the hint streams and validates that object ordering, parameters, and hint stream 
contents are correct. The validation code was first tested against linearized files created by external tools (Acrobat and 
pdlin) and then used to validate files created by OPDFWriter itself. 

7.2. Preparing For Linearization 

Before creating a linearized PDF file from any other PDF file, the PDF file must be altered such that all page attributes 
are propagated down to the page level (and not inherited from parents in the /Pages tree). We also have to know 
which objects refer to which other objects, being concerned with page boundaries and a few other cases. We refer to 
this part of preparing the PDF file as optimization, discussed in Section 7.3, ‘ Optimization”, page 24. Note the, in 
this context, the term optimization is a qpdf term, and the term linearization is a term from the PDF specification. Do 
nol be confused by the fact: that many applications refer to linearization as optimization or web optimization. 

When creating linearized PDF files from optimized PDF files, there are really only a few issues that need to be dealt 
with: 

• Creation of hints tables 

• Placing objects in the correct order 

• Filling in offsets and byte sizes 

7.3. Optimization 

In order to perform various operations such as linearization and splitting files into pages, it is necessary to know which 
objects are referenced by which pages, page thumbnails, and root and trailer dictionary keys. It is also necessary to 
ensure that all page-level attributes appear directly at the page level and are not inherited from parents in the pages tree. 

We refer to the process of enforcing these constraints as optimization. As mentioned above, note that some applications 
refer to linearization as optimization. Although this optimization was initially motivated by the need to create linearized 
files, we are using these terms separately. 

PDF tile optimi cation is implemented in the QPDF_optimization.cc source file. That file is richly commented and 
serves as the primary reference for the optimization process. 

After optimization has been completed, the private member variables obj_user_to_objects and object_to_obj_users in 
QPDFliave been populated. Any object that has more than one value in the objectJo_obj_users table is shared. Any 
object that has exactly one value in the objectJo_objjisers table is private. To find all the private objects in a page or 
a trailer or root dictionary key, one merely has make this determination for each element in the obj_userJo_objects 
table for the given page or key. 

Note that pages and thumbnails have different object user types, so the above test on a page will not include objects 
referenced b\ the page's thumbnail dictionaiy and nothing else. 
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7.4. Writing Linearized Files 

We will create files with only primary hint streams. We w ill never write overflow hint streams. (As of PDF v ersion 1.4, 
Acrobat doesn't either, and they are never necessary.) The hint streams contain offset information to objects that point 
to wheie they would be if the hint stream were not present. This means that we have to calculate all object positions 
before we can generate and write the hint table. This means thal we have to generate the file in two passes. To make 
this reliable, QPDFWriter in linearization mode invokes exactly the same code twice to write the file to a pipeline. 

In the first pass, the target pipeline is a count pipeline chained to a discard pipeline. The count pipeline simply passes 
its data through to the next pipeline in the chain but can return the number of bytes passed through it at any intermediate 
point The discard pipeline is an end of hue pipeline that just throws its data away. I he hint stream is not written and 
dummy values with adequate padding are stored in the first cross reference table, linearization parameter dictionary, 
and /Prev key ot the first trailer dictionary. All the offset length, object renumbering intormation, and anything else 
we need for the second pass is stored. 

Al the end of the first pass, this information is passed to the QPDF class which constructs a compressed hint stream 
in a memory buf fer and returns it. QPDFWriter uses this information to write a complete hint stream object into a 
memory buffer. At this point, the length of the hint stream is known. 

In the second pass, the end of the pipeline chain is a regular file instead of a discard pipeline, and we have known values 
for all the offsets and lengths that we didn't have in the first pass. We have to adjust offsets that appear after the start of 
die hint stream by the length of the hint stream, which is known Any thing that is of variable length is padded, with the 
padding code surrounding any writing code that differs m the two passes. This ensures that changes to the way tilings 
are represented never results in offsets that were gathered during the first pass becoming incorrect for the second pass. 

Using this strategy, we can write linearized files to a non-seckablc output stream with only a single pass to disk or 
wherever the output is going. 

7.5. Calculating Linearization Data 

Once a file is optimized, we have information about which objects access which other objects. We can then process 
these tables to decide which part (as described in “Linearized PDF Document Structure” in the PDF specification) 
each object is contained within This tells us the exact order in which objects are written. The QPDFWriter class, 
asks for this infoi mation and enqueues objects for writing in the propel order. It also turns on a check that causes an 
exception to be thrown if an object is encountered that has not already been queued. ^This could happen only if there 
were a bug in the traversal code used to calculate the linearization data.; 

7.6. Known Issues with Linearization 


There are a handful of known issues with this linearization code These issues do not appear to impact the behavior of 
linearized files which still work as intended: it is possible for a web browser to begin to display them before they are 
hilly downloaded. In fact, it seems that various other programs that create lnrearized files ha\ e many of these same 
issues. These items make reference to terminology used in the linearization appendix of the PDF specification. 

• Thread Dictionary information keys appear in part 4 with the rest of Threads instead of in part 9. Objects in part 
9 are not grouped together functionally. 

• We are not calculaung numerators for shared object positions within content streams or interleaving them within 
content streams. 

• We generate only page offset shared object, and outline hint tables. It would be relatively easy to add some additional 
tables. We gather most of the information needed to create thumbnail hint tables. There are comments in the code 
about this. 
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7.7. Debugging Note 

The qpdf —show-linearization command can show the complete contents of linearization hint streams. To look at 
the raw data, you can extract the filtered contents of the linearization hint tables using qpdf ~show-ohject-=n -fil- 
tt red-stream-data. Then, to convert this into a bit stream (since linearization tables are bit streams written without 
regard to byte boundaries), you can pipe the resulting data through the following peri code: 


use bytes; 

binruode STD1N; 

undef $/; 

my $a = <STDIN>; 

my @ch = split(//, $a) ; 

map { printf("%08b", ord($_)) } @ch; 

print "\n"; 
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Chapter 8. Object and Cross-Reference 
Streams 

Tha chapter provides information about the implementation of object stream and cross-reference stream support in 
qpdf. 

8.1. Object Streams 

Object streams can contain any regular object except the following: 

• stream objects 

• objects with generation > 0 

• the encryption dictionary 

• objects containing the /Length of another stream 

In addition. Adobe reader (at least as of version 8.0.0) appears to nol be able to handle having the document catalog 
appear in an object stream if the file is encrypted, though this is not specifically disallowed by the specification. 

There axe additional restrictions for linearized files. See Section 8.3, “Implications for Linearized Files”, page 28for 
details. 

The PDF specification refers to objects in object streams as "compressed objects” regardless of whether the object 
stream is compressed. 

The generation number of every object in an object stream must be zero. It is possible to delete and replace an object 
in an object stream with a regular object. 

The object stream dictionary has the following keys: 

• /N: number of objects 

• /First: byte offset of first object 

• /Extends: indirect reference to stream that this extends 

Stream collections are formed with /Extends. They must form a directed acyclic graph. These can be used for 
semantic information and are not meaningful to the PDF document's syntactic structure. Although qpdf preserves 
stream collections, it never generates them and doesn't make use of this information in any way. 

The specification recommends limiting the number of objects in object stream for efficiency in reading and decoding. 
Acrobat 6 uses no more than 100 objects per object stream for linearized files and no more 200 objects per stream for 
non-lineanzed files. QPDFWriter in object stream generation mode, never puts more than 100 objects in an object 
stream. 

Object stream contents consists of N pairs of integers, each of which is the object number and the byte offset of the 
object relative to the first object in the stream, followed by the objects themselves, concatenated. 

8.2. Cross-Reference Streams 


For non-hybrid files, the value following startxref is the byte offset to thexref stream rather than the word xref. 
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For hybrid files (files containing both xref tables and cross-reference streams), the xref table's trailer dictionary contains 
the key /XRef Stm whose value is the byte offset to a cross-reference stream that supplements the xref table. A 
PDF 1.5-comp liaiit application should read the xref table first. Then it should replace any object that it has already 
seen with any defined in the xref stream. Then it sho'ild follow any /Frev pointer in the original xref table's trailer 
dictionary The specification is noi clear about what should be done, if anything with a /Prev pointer in the xref 
stream referenced by an xref table. The QPDF class ignores it, which is probably reasonable since, if this case were 
to appear for any sensible PDF file, the previous xref table would probably have a corresponding /XRe f Stm pointer 
of its own. For example, if a hybrid file were appended, the appended section would have its own xref table and / 
XRe f Stm. The appended xref table would point to the previous xref table which would point the /XRe f Stm meaning 
that the new / XRe f Stm doesn't have to point to it. 

Since xref streams must be read very early, they may nol be encrypted, and the may not contain indirect objects for 
keys required to read them, which are these; 

• /Type: value /XRef 

• /Size: value n+1: where n is highest object number (same as / S i z e in the nailer dictionary ) 

• /Index (optional): value [n count ...] used to determine which objects’intiamation is stored in this stream. 
The def ault is [ 0 /Size]. 

• /Prev: value offset: byte offset of previous xref stream (same as /Prev in the trailer dictionary) 

• /w [. . . J: sizes of each field in the xref table 

The other fields in the xref stream, which may be indireel if desired ore the union of those From the xref table's trailer 
dictionary. 

8.2.1. Cross-Reference Stream Data 

The stream data is binary and encoded in big-endian byte order. Entries are concatenated, and each entry ha» a length 
equal to the total of the entries in /w above. Each entry consists of one or more fields, the first of which is the type of 
the field. The number of bytes for each field is given by /W above. A 0 in /W indicate* that the field is omitted and 
has the default \alue. The default value for the field ■ype is “1”. All other default values are “0”. 

PDF 1.5 has three field types: 

• 0: for free objects. Format: 0 obj next-generation, same as the free table in a traditional cross-reference table 

• 1: regularnon-compressedobject. Format: 1 offset generation 

• 2: for objects in object streams Format: 2 object-stream-number index, the number of object stream 
containing the objeci and the index wiihm the object stream of die object. 

It seems standard to have the first entry in the table be 0 0 0 instead of 0 0 f f f f if there are no deleted objects. 

8.3. Implications for Linearized Files 

For linearized files, the linearization dictionary, document catalog, and page objects may not be contained in object 
streams. 

Objects stored within object streams are given the highest range of object numbers within the main and first-page 
cross-reference sections. 

It is okay to use cross-reference streams in place of regular xref tables. There are on special considerations. 
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Hint data refers to object streams themselves, not the objects in the streams. Shared object references should also be 
made to the object streams. There are no reference in any hint tables to the object numbers of compressed objects 
(objects within object streams). 

When numbering objects, all shared objects within both the first and second halves of the linearized files must be 
numbered consecutively after all normal uncompressed objects in that half. 

8.4. Implementation Notes 

There are three mode* for writing object streams: disable, preserve, and generate In disable mode, we do not generate 
any object streams, and we also generate an xref table rather than xref streams This can be used to generate PDF 
files that are viewable with older readers. In preserve mode, we write object streams such that written object streams 
contain the same objects and /Extends relationships as in the original file. This is equal to disable if the file has no 
object streams. In generate, we create object streams ourselves by grouping objects that are allowed in object streams 
together in sets of no more than 100 objects. We also ensure thal the PDF version is at least 1.5 in generate mode, but 
we preserve the version header in the othei modes. The default is preserve. 

We do not support creation of hybrid files. When we write files, even in preserve mode, we will lose any xref tables 
and merge any appended section®. 
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Appendix A. Release Notes 

For a detailed list of changes, please see the file ChungeLog in the source distribution. 

7.0.0: Sepiember 15,2017 

• Packaging and Distribution Changes 

• QPDFs primary license is now version 2.0 of the Apache License [http://www.apache.org/licenses/Ll- 
CENSE-2.0] rather than version 2.0 of the Artistic License. You may still, at your option, consider qpdf to 
be licensed with version 2.0 of the Artistic license. 

» QPDF no longer has a dependency on the PCRE (Perl-Compatible Regular Expression) library. QPDF now 
has an added dependency on the JPEG library. 

• Bug Fixes 

• This release contains many bug fixes for various infinite loops, memory leaks, and other memory errors that 
could be encountered with specially craf ted or otherwise erroneous PDF files. 

• New Features 

• QPDF now supports reading and writing streams encoded with JPEG or RunLength encoding. Li¬ 
brary API enhancements and command-line options have been added to control this behavior. See com¬ 
mand-line options -compress-streams and -deeode-level and methods QPDFWriter::setCompressStreams 
and QPDFWriterr.setDecodeLevel. 

• QPDF is much better at recovering from broken files. In most cases, qpdf will skip invalid objects and will 
preserve broken stream data by not attempting to filter broken streams. QPDF is now able to recover or at 
least not crash on dozens of broken test files I have received over the past few years. 

• Page rotation is now supported and accessible from both the library and the command line. 

• QPDFWriter supports writing files in a way that preserves PCLm compliance in support of driverless print¬ 
ing. This is very specialized and is only useful to applications that already know how to create PCLm files. 

• Enhancements to the qpdf Command-line Tool. All new opuons listed here are documented in more detail in 

Chapter 3, Running QPDF , page 4. 

• Command-line arguments can now be read from files or standard input using @ f ile or @- syntax. Please 

see Section 3.1, "Basic Invocation”, page 4. 

• -rotate: request page rotation 

• —newline-before-endstream. ensure that anewline appears before every endst ream keyword in the file; 
used to prevent qpdf from breaking PDF/A compliance on already compliant files. 

• —preserve-unreferenced preserve unreferenced objects in the input PDF 

» -split-pages: break output into chunks with fixed numbers of pages 

• —verbose: print the name of each output file that is created 

• -compress-streams and -decode-level replace -stream-data for improving granularity of controlling 
compression and decompression of stream data. The -stream-data option will remain available. 
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• When ruiming qpdi --check w ith other options, checks are always run first. This enables qpdf to perform 
its full recovery logic before outputting other information. This can be especially useful when manually 
recovering broken files, looking at qpdf s regenerated cross reference table, or other similar operations. 

• Process —pages earlier so that other options like -show-pages or -split-pages can operate on the file after 
page splitting/merging has occurred. 

• API Changes. All new API calls are documented ir their respective classes' header files. 

• QPDFObm tHandle:: rotate Page: apply rotation to a page object 

• QPDFWi iter: :setNewlineBeforeP,ndsiream\ force newline to appear before endstream 

• QPDF Writer:: setPreservrUnreferem edObjects: preserve unreferenced objects that appear in the input PDF. 
The default behavior is to discard them. 

• New Pipeline types PI RunLength and PI DCT are available for developers who wish to produce or 
consume Run! engch or DCT sire am data directly. The examples/pdf-create.cc example illustrates their use. 

• QPDFWriter::setCompressStream s and QPDFWrittrr.setDevodeLerel methods control handling of difter- 
ent types of stream compression. 

• Add new’ C API functions qpdf_set_cnmpress_str earns, qpdf_set_decode_level, qpdj_set_pteser\ e_unrefer¬ 
enced objects, and qpdf_set_nmline_before_endstream corresponding to the new QPDFWntei methods. 

6.0.0: November 10, 2015 

• Implement -deterministic-id command-line option and QPDFWriter::setDeterministiclD as well as C API 
function qpdf_set_deterministk_ID for generating a deterministic ID for non-encrypted files. When this option 
is selected the ID of the file depends on the contents of the output file, and not on transient items such as the 
timestamp or output file name. 

• Make qpdf more tolerant of files whose vref table entries are not the correct length. 

5.1.3: May 24, 2015 

• Bug fix : fix-qdf was not properl) handling files that contained object streams with more than 255 objects in 
them. 

• Bug fix: qpdi was nol properly initializing Microsoft's secure uypto provider on fresh Windows installations 
that had not had any keys created yet. 

• Fix a few errors found by Gvnvael Coklwind and Mateusz Jurczyk of the Google Sec urity Team Please see 
the ChangeLog for details. 

• Properl) handle pages that have no contents at all. There were many cases in which qpdf handled this fine, but 
a few methods blindly obtained page contents with handling the possibility that there were no contents. 

• Make qpdf more robust tor a few more kinds of problems that may occur in invalid PE'F files. 

5.12: June 7, 2014 

• Bug fix: linearizing files could create a corrupted output file under extremely unlikely file size circumstances. 
See ChangeLog for details. The odds of getting hit by this are very low, though one person did. 

• Bug fix: qpdf would fail to write files that had streams with decode parameters referencing other streams. 
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• New example program pdf-split-pages: efficiently split PDF files into individual pages. The example program 
does this more efficiently than using qpdf -pages to do it 

• Packaging fix. Visual C++ binaries did not support Windows XP. This has been rectified by updating the 
compilers used to generate the release binaries. 

5.1 1: January 14, 2014 

• Performance fix. copying foreign objects could be very slow witn certain types of files. This was most likely 
to be visible during page splitting and was due to traversing the same objects mulnple times in some cases. 

5.1.0: December 17,2013 

• Added runtime option (QUiil::sexRandomDataProvider> to supply your own random data provider. You can 
use this if you want to avoid using the OS-provided secure random number generation facility or stdlib's less 
secure version. See comments in include/cpdf/QUtil hh for details. 

• Fixed image comparison tests to not create 12-bit-per-pixel images since some versions of tiffcmp have bugs 
in comparing them in some cases. This increases the disk space required by the image comparison tests, which 
are off by default anyway. 

• Introduce a number of small fixes for compdation on the latest clang in MaeOS and the latest Visual C++ in 
Windows. 

• Be able to handle broken files thal end the xref table header with a apace instead of a new line 

5.0.1: October 18. >013 

• Thanks to a detailed review by Florian Weimer and the Red Hat Product Security Team, this release includes a 
number of non-user-visible security hardening changes. Please see the Chang^Log file in the source distribution 
for the complete list. 

• When available operating system-specific secure random number generation is used for generating initializa¬ 
tion vectors and other r rndom values used during encryption or file creation. For the V indows build, this results 
in an added dependency on Microsoft's crvptography .API. To disable the OS-specific cryptography and use the 
old version, pass the — enable-insecure-random upturn to ./configure 

• The qpdf command-line tool now issues a warning when -accessibility=n is specified for newer encryption 
versions stating that the option is ignored, qpdf, per the spec, has always ignored this flag, but it previously 
did so silently. This warning is issued only by the command-line tool, not by the library. The library's handling 
of this flag is unchanged. 

5.0.0: July 10, 2013 

• Bug fix: previous versions of qpdf would lose objects with generation != 0 when generating object streams. 
Fixing this required changes to the public API. 

• Removed methods from public API (hat were only supposed to be called by QPDFWriter and couldn’t realisti 
cally be called anywhere else. See Change Log for details. 

• New QPDFOb j Gen class added to represent an object ID/gcnerahon pair (JPDFObjectHondle::getOhjGen() is 
now preferred over QPDFObjectHandle::getObjectIDf} and QPDFObjectHondle: :getGeneration() as ii makes 
it less likely for people to accidentally write code that ignores the generation nambe r. See QPDF.hh and 
QPDFObjectHandle.hh for additional notes. 

• Add — show-npages command line option to the qpdf command to show the number of pages in a file. 
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• Allow omission of the page range within -pages for the apdf command. When omitted, the page range is 
implicitly taken to be all the pages in the tile. 

• Various enhancements were made to support different types of broken files or broken readers. Details can be 
found in ChanseLog. 

4.1 0: April 14,2013 

• Note to people inc hiding qpdf in distributions: the la files generated by libtooi are now installed b) qpdf s make 
install target. Before, they were not installed. This means that if your distribution does not wanl to include .la 
files, you must remove them as pail of your packaging process. 

• Major enhancement API enhancements have been made to suppoi t parsing of content streams. This enhance¬ 
ment includes the following changes: 

• QPDFObjectHandlp::parseComentSTreom method parses objects in a content stream and calls handlers in a 
callback class. The example examples/pdf-parse-ccntent.cc illustrates how this may be used. 

• QPDFOb j ectHand.l e can now represent operators and inline images, object types that may only appear 
in content streams. 

• Method QPDFObjectHandle: :getTypeCode() returns an enumerated type value representing the underlying 
object type. Method QPDFUbjectHandle::gctTypeName() returns a text string describing the name of the 
type of a QPDFObjectHandle object. These methods can be used for more efficient parsing and debug¬ 
ging/diagnostic messages. 

• qpdf —check now parses all pages' content streams in addition to doing other checks. While there are still many 
types of errors that cannot be detected, syntactic errors in content streams will now be reported. 

• Minor compilation enhancements have been made to facilitate easier for support for a broader range of compilers 
and compiler versions. 

• Warning flags have been moved into a separate variable in autoconf.mk 

• The configure flag — enable-werror w ork for Microsoft compilers 

• All MSVC CRT security warnings have been resolved. 

• Ail C-style casts in C++ Code have been replaced by C++ casts, and many casts thal had been included to 
suppress higher warning levels for some compilers have been removed, primarily for clarity. Places where 
integer type coercion occurs have been scrutinized A new casting policy has been documented in the manuaL 
This is of concern mainly to people porting qpdf to new platforms or compilers. It is noi visible to program¬ 
mers writing code that uses the library 

• Some internal limits have been removed in code that converts numbers to strings. This is largely invisible 
to users, but it does trigger a bug in some older versions of mingw-w64’s C++ library. See RF.ADME-win- 
dows.md in the source distribution if you think this may affect you. The copy of the DLL distributed with 
qpdf s binary distribution is not affected b\ this problem. 

• The RPM spec file previously included with qpdf has been removed. This is because virtually all Linux distri ■ 
butions include qpdf now that it is a dependency of CUPS filters. 

• A few bug fixes are included: 

• Overridden compressed objects are properlj handled, before, there were certain constructs thal could cause 
qpdf to see old versions of some objects. The most usual manifestation of this was loss of filled in form 
values for certain files. 
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• Installation no longer uses GNlJ/Linux-specific versions of some commands so make install works on 
Solaris with native tools. 

• The 64-bit mingw Windows binary package no longer includes a 32-bn DLL 
4.0.1: January 17, 2013 

• Fix detection of binary attachments in test suite to avoid false test failures on some platforms. 

• Add clarifying comment in QPDF.hh to methods that return the user password explaining that it is no longer 
possible with newer enct yption formats to recover the user password know ing the owner password. In earlier 
encryption formats, the user password was encrypted in the file using the owner password. In newer enci yption 
formats, a separate encry ption key is used on the file, and that key is independently encrypted using both the 
user password and the owner password. 

4.0.0: December 31, 2012 

• Major enhancement: support has been added for newer encryption schemes supported by version X of Adobe 
Acrobat. This includes use of 127-character passwords, 256-bit encryption keys, and the encryption scheme 
specified in ISO 32000-2, the PDF 2.0 specification. This scheme can be chosen from the command line by 
specifying use of 256-bit keys, qpdf also supports the deprecated encryption method used by Acrobat IX. This 
encryption style has known security weaknesses and should not be used in practice. However, such files exist ‘in 
the wild,” so support for this scheme is still useful. New methods QPDFWriter::setR6EncryptionParameters 
(for the PDF 2.0 scheme) and QPDFWriter::setR5EncryptionParameters (for the deprecated scheme) have 
been added to enable these new encryption schemes. Corresponding functions have been added to the C API 
as well. 

• Full support for Adobe extension levels in PDF version information. Starting with PDF version 1.7, corre 
sponding to ISO 32000. Adobe adds new functionality by increasing the extension level rather than increasing 
the version. This support includes addition of the QPDF::getExtpnsionLevel method for retrieving the docu ¬ 
ment's extension level, addition of versions of QPDFWriter::sctMinimumPDFVersion and QPDFWriter::for- 
cePDFVersion that accept an extension level, and extended syntax foi specifying forced and minimum versions 
on the command line as described in Section 3.5, “Advanced Transformation Options”, page 9. Corresponding 
functions have been added to the C API as well. 

• Minor fixes to prevent qpdf from referencing objects in the file that are not referenced in the file's overall 
structure. Most files don't have any such objects, but some files have contain unreferenced objects with errors, 
so these fixes prevent qpdf from needlessly rejecting or complaining about such objects. 

• Add new generalized methods for reading and writing files from/to programmer-defined sources. The 
method QPDF: :processInputSource allows the programmer to use any input source for the input file, and 
QPDF Writer: .setOutput Pipeline allows the programmer to write the output file through any pipeline These 
methods would make it possible to perform any number of specialized operations, such as accessing external 
storage sy stems, creating bindings for qpdf in other programming languages that have their own I/O systems, 
etc. 

• Add new method QPDF: .getEncryptionKey for retrieving the underlying encryption key used in the file. 

• This release includes a small handful of non-compatible API changes. While effort is made to avoid such 
changes, all the non-compatible API changes in this version were to parts of the API that would likely never 
be used outside the library itself. In all cases, the altered methods or structures were parts of the QPDF that 
were public to enable them to be called from either QPDFWtiter or were part of \ alidation code that was over- 
zealous in reporting problems in parts of the file that would not ordinarily be referenced. In no case did any of 
the removed methods do anything worse that falsely report error conditions in files that were broken in ways 
that didn't matter. The following public parts of the QPDF class were changed in a non-compatible way: 
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» Updatednested QPDF::EncryptlonData class to add fields needed by the newer encryption formats, mem¬ 
ber variables changed to private so that future changes will not require breaking backward compatibility. 

• Added addinonal parameters to compute_data_key, which is used by QPDFWriterto compute the enc ryp¬ 
tion key used to encrypt a specific object. 

• Removed the method flcUlenScalarReferences. This method was previously used prior to writing a new PDF 
file, but it has the undesired side effect of causing qpdf to read objects in the file that were not referenced. 
Some otherw ise tiles have unreferenced objects with errors in them, so this could cause qpdf to reject files 
that would be accepted by \ irtually all other PDF readers, in fact, qpdf relied on only a very small part of 
what tlattenScalai References did. so only this part has been preserved, and it is now done directly inside 
OPDFWriter. 

• Removed the method decodeStreams. This method was used by the —check opti on ol the qpdf < ommand-line 
tool to force all streams in the file to be decoded, but it also suffered from the problem of opening otherw ise 
unreferenced streams andthus couldreporl false positive. The —check option now causes qpdf to go through 
all the motions of writing a new file based on the original one, so it will alway s reference and check exactly 
those parts of a file that any ordinary viewer would check. 

• Removed the method trimTrailerForWrite. This method was used by QPDFWriterto modify the original 
QPDF object by removing fields from the trailer dictionary that wouldn't apply to the newly written file. 
This functionality, though generally harmless, was a poor implementation and has been replaced by having 
QPDFWliter filter these out when copying the trailer rather than modifying the original QPDF object. (Note 
that qpdf never modtfies the original file itself.) 

• Allow the PDF header to appear anywhere in the first 1024 bytes of the file. Ths is consistent with what other 
readers do. 

• Fix the pkg-config files to list zlib and pere in Requires.private to better support static linking using pkg-config. 

3.0.2: September 6, 2012 

• Bug fix: QPDFWriterr.setOutputMemory did not work when not used with QPDFWriter::setStaticID, which 
made it pretty much useless. This has been fixed 

• New API call QPDFWritery.setExtraHeaderText inserts additional text near the header of the PDF file. The 
intended use case is to insert comments that may be consumed by a downstream application, though other use 
cases may exist 

3.0.1: August 11, 2012 

• Version 3.0.0 included addition of files for pkg-config but this was not mentioned in the release notes. The 
release notes for 3.0.0 were updated to mention this. 

• Bug fix: if an object stream ended with a scalar object not f ollowed by space, qpdf would incorrectly report that 
it encountered a premature EOF. This bug has been in qpdf since version 2.0. 

3.0.0: August 2, 2012 

• Acknowledgment. I would like to express gratitude for the contributions of Tobias Hoffmann toward the release 
of qpdf version 3.0. He is responsible for most of the implementation and design of the new API for manipulating 
pages, and contributed code and ideas for many of the improvements made in version 3.0. Without his work, 
this release would certainly not have happened as soon as it did, if at all. 

• Non-compatible API change: The version of QPDFObjectHandle::replaceStreamData thatuses a Stream Dat- 
aProvider no longer requires (or accepts) a length parameter. See Appendix C, Upgrading to 3.0, page 42 
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for an explanation. While care is taken to avoid non-compatible API changes in general, an exception was made 
this time because the new interface offers an opportunity to significantly simplify calling code. 

• Support has been added for large files. The test suite verifies support for files larger than 4 gigabytes, and 
manual testing has verified support for files larger than 10 gigabytes Large file support is available for both 
32-bit and 64-bit platf orms as long as the compiler and underlying platforms support it. 

• Support for page selection (splitting and merging PDF files) has been added to the qpdf command-line tool. 

See Section 3.4, “Page Selection Options”, page 8. 

• Options have been added to the qpdf command-line tool for copying encryption parameters from another file. 

See Section 3.2, “Basic Options”, page 4. 

• New methods have been added to the QPDF object for adding and removing pages. See Section 6.6, “Adding 
and Removing Pages”, page 21. 

• New methods have been added to the QPDF object for copying objects from other PDF files. See Section 6.8, 
“Copying Objects From Other PDF Files”, page 22 

• A new method QPDFObjectHandle:.-parse has been added for constructing QPDFObjectHandle objects 
from a string description. 

• Methods have been added to QPDFWriter to allow writing to an already open stdio FILE* addition to writing 
to standard output or a named file. Methods have been added to QPDF to be able to process a file from an 
already open stdio FILE*. This makes it possible to read and write PDF from secure temporary files that have 
been unlinked prior to being fully read or written. 

• The QPDF::emptyPDF can be used to allow creation of PDF files from scratch The example examples/pdf- 
create.cc illustrates how it can be used. 

• Several methods to take PointerHolder<Buffer> can now also accept std: : string arguments. 

• Many new convenience methods have been added to the library, most in QPDFObjectHandle. See ChangeL- 
og for a full list. 

• WTien building on a platform that supports El F shared libraries (such as Linux), symbol versions are enabled 
by default. They can be disabled by passing - -disable-ld-versinn-script to ./configure 

• The file libqpdf.pc is now installed to support pkg-config. 

• Image comparison tests are off by default now since they are not needed to verify a correct build or port of 
qpdf. They are needed only when changing the actual PDF output generated by qpdf. You should enable them 
if you are making deep changes to qpdf itself. See README.md for details. 

• Large file tests are off by default but can be turned on with ./configure or by setting an environment variable 
before running the test suite. See README.md for details. 

• When qpdf s test suite fails, failures are not printed to the terminal anymore by default. Instead, find them m 
buildJqtest.log. For packagers who are building with an autobuilder, you can add the -enahle-show-failed- 
test-outpat option to ./configure to restore the old behavior. 

2.3.1: December 28, 2011 

• Fix thread-safety problem resulting from non-thread-safe use of the PCRE library. 

• Made a few minor documentation fixes. 
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• Add workaround for a bug that appears in some versions of ghostscript to the test suite 

• Fix minor build issue for Visual C++ 2010. 

2.3.0: August 11, 2011 

• Bug fix: when preserving existing encryption on encrypted files with cleartext metadata, older qpdf versions 
would generate password-protected files with no valid password. This operation now works. This bug only af¬ 
fected files created by copying existing encryption parameters; explicit encryption with specification of clear¬ 
text metadata worked before and continues to work. 

• Enhance QPDFWriter with d new constructor that allows you to delay toe specification of the output file. 
When using this constructor, you may now call QPDFWriter: -.setOutputFilename to specify the output file, 
or you may use QPDFWriter r.setOutputMemory to cause QPDFWriter to write the resulting PDF file to a 
memory buffer. You may then use QPDFWriter::getBuffer to retrieve ihe memory buffer. 

• Add new API call QPDF::replaceObject for replacing objects by object ID 

• Add new API call QPDF::swapObjects for swapping two objects by object: ID 

• Add QPDFC )bjec tHand le: :ge tDic tAs Map and QPDFObjcctHandle::getArrayAsVector to allow retrieval of 
dictionary objects as maps and array objects as vectors. 

• Add functions qpdf_get_info_key and qpdf_set_info_key to the C API for manipulating string fields of the 
document's /Info dictionary. 

• Add functions qpdf_init_write_memory, qpdf_get_buffer_length, and qpdf_get_buffer to the C API for writing 
PDF files to a memory buffer instead of a file. 

2.2.4: June 25, 2011 

• Fix installation and compilation issues; no functionality changes. 

2.2.3: April 30, 2011 

• Handle some damaged streams with incorrect characters following the stream keyword. 

• Improve handling of inline images when normalizing content streams. 

• Enhance error recovery to properly handle files that use object 0 as a regular object, which is specifically 
disallowed by the spec. 

2.2.2: October 4, 2010 

• Add new function qpdf_read_memory to the C API to call QPDF:.processMemoryFile. This was an omission 
in qpdf 2.2.1. 

2.2.1: October 1, 2010 

• Add new method QPDF::set(JutputStreams to replace std::cout and std::cerr with other streams for generation 
of diagnostic messages and error messages. This can be useful for GUIs or other applications that want to 
capture any output generated by the library to present to the user in some other way. Note that QPDF does 
not write to std::cout (or the specified output stream) except where explicitly mentioned in QPDF.hh, and 
that the only use of the error scream is for warnings. Note also tiiar ourpur of warnings is suppressed when 
setSuppressWarnings (true) is called. 
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• Add new method QPDF. .processMemoryFile for operating on PDF files that are loaded into memory rather 
than in a file on disk. 

• Give a warning but otherwise ignore empty PDI objects by treating them as null. Empty object are not permitted 
by the PDF specification but have been known to appear in somt actual PDF files. 

• Handle inline image filter abbreviations when the appeal as stream filter abbreviations, The PDF specification 
does not allow use of stream filter abbreviations in this way, but Adobe Reader and some other PDF readers 
accept them since they sometimes appear incorrectly in actual PDF files. 

• Implement miscellaneous enhancements to PointerHolder ant Buffer to support other changes. 

2.2.0: August 14, 2010 

• Add new methods to QPDFObjectHandle (newStream and replaceStrcamData for creating new streams and 
replacing stream data. This makes it possible to perform a wide range of operations th.it were not previously 
possible. 

• Addnew helper methodin QPDFObjectHandle(addPageContents) for appending or prepending new content 
streams to a page. This method makes it possible to manipulate content streams without having to be concerned 
whether a page's contents are a “ingle stream or an array of streams. 

• Add new method in QPDFObjectHandle: replaceOrRemoveKey, which replaces a dicuonary key with a 
given value unless the value is null, in which case it removes the key instead. 

• Add new method in QPDFObjectHandle. getRm StreamData, which returns the raw (unfiltered) stream data 
into a buffer. This complements the getStreamData method, w hich returns the filtered (uncompressed) stream 
data and can only be used when the stream's data is filterable. 

• Provide two new examples: pdf-double-page-size and pdf-invert-images that illustrate the newly added in¬ 
terfaces. 

• Fix a memory leak that would cause loss of a few bytes for every object involved in a cycle of object references. 

flanks to Jian Ma for calling my attention to the leak. 

2.1.5: April 25,2010 

• Remove restriction of file identifier strings to 16 bytes. This unnecessary restriction was preventing qpdf from 
being able to encrypt or decrypt files with identifier strings tha! were not exactly 16 bytes long. Th specification 
imposes no such restriction. 

2.1.4: April 18,2010 

• Apply the same padding calculation fix from version 2.1.2 to the main cross reference stream as well. 

• Since qpdf —check only performs limiied checks, clarify the output to make it clear that there still may be 
errors that qpdf can't check. This should make it less surprising to people when another PDF reader is unable 
to read a file that qpdf thinks is okay. 

2.1 3: March 27, 2010 

• Fix bug that could cause a failure when rewriting PDF files that contain object streams with unreferenced objects 
that in turn reference indirect scalars. 

• Don't complain about (invalid) AES streams that aren't a multiple of 16 bytes. Instead, pad them before de- 
crypring, 
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2.1,2: January 24, 2010 

• Fix bug in padding around first half cross reference stream in linearized files. The bug could cause an assertion 
failure when linearizing certain unlucky files. 

2,1.1: December 14, 2009 

• No changes in functionality; insert missing include in an internal library header file to support gcc 4.4, and 
update test suite to ignore broken Adobe Reader installations. 

2.1: October 30, 2009 

• This is the first version of qpdi to include Windows support. On Windows, it is possible to build a DLL. Addi ■ 
tionally, a partial C-language API has been introduced, which makes it possible to call qpdf functions fromnon- 
C++ environments. 1 am very grateful to Zarko Gagic (http;//delphi about.com/) for tirelessly testing numerous 
pre-release versions of this DLL and providing many excellent suggesuons on improving the interface. 

For programming to the C interface, please see the header file qpdf/qpdf-c.h and the example examples/pdf- 
linearize.c. 

• Zarko Gajic has written a Delphi wrapper for qpdf, which can be downloaded from qpdf s download side. 
Zarko's Delphi wrapper is released with the same hcensing terms as qpdf itself and comes with this disclaimer: 
“Delphi wrapper unit qpdf.pas created by Zarko Gajic (http://delphi.about.com/). Use at your own risk and for 
whatever purpose you want. No support is provided- Sample code is provided.” 

• Support has been added for AES encryption and crypt filters. Although qpdf does not presendy support files 
that use PKl-based encryption with the addition of AES and crypt filters, qpdf is now be able to open most 
encrypted files created with newer versions of Acrobat or other PDF creation software. Note that 1 ha ve not 
been able to get very many files encrypted in this way. so it's possible there could still be some cases that qpdf 
can't handle. Please report them if you find them. 

• Many error messages have been improved to include more information m hopes of making qpdf a more useful 
tool for PDF experts to use in manually recove ring damaged PDF files. 

• Attempt to avoid compressing metadata streams if possible. This is consistent with other PDF creation appli 
cations. 

• Provide new command-line options for AES encrypt cleartext metadata, and setting the minimum and forced 
PDF versions of output files. 

• Add additional methods to the QPDF object for querying the document's permissions. Although qpdf does 
not enforce these permissions, it does make them available so that applications that use qpdf can enforce per¬ 
missions. 

• The —check option to qpdf has been extended to include some additional information. 

• There have been a handful of non-compatible API changes. For details, see Appendix B, Upgrading from 2.0 
to 2.1, page 41. 

2.0.6: May 3, 2009 

• Do not attempt to uncompress streams that have decode parameters we don't recognize. Earlier versions of qpdf 
would have rejected files with such streams. 

2.0.5: March 10, 2009 

• Improve error handling in the LZW decoder, and fix a small error introduced in the previous version with regard 
to handling full tables. The LZW decoder has been more strongly verified in this release. 
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2.0.4: ftbruary 21, 2009 

• Include proper support for LZW streams encoded v. ithout rhe “early code change” flag. Special thanks to Mom 
Smasher who reported the problem and provided an input tile compressed in this way. which I did not previously 
have. 

• Implement some improvements to file recovery logic. 

2.0.3: ftbruary 15, 2009 

• Compile clear'y with gcc 4.4. 

• Handle strings encoded as UTF-16BE properly. 

2.0.2: June 30, 2008 

• Update rest suite to work properly with a non-bash foin/sh and w ith Perl 5.10. No changes were made to the 
actual qpdf source code itself for thi., release 

2.0.1: May 6, 2008 

• No changes in functionality or interface. This release includes fixes to the source code so that qpdf compiles 
properly and passes its test suite on a broader range of platforms. Sec ChangeU<g in the source dish ibution 
for detail s. 

2.0: April 29,2008 

• First public release 


40 



Appendix B. Upgrading from 2.0 to 2.1 

Although, as a general rule, we like to avoid introducing source-level incompatibilities in qpdf s interface, there were a 

tew non-compatible changes made in this version. A considerable amount of source code that uses qpdf will probably 

compile without any changes, but in some cases, you may have to update your code. The changes are enumerated here. 

Theic arc also some new interfaces; for those, please refer to the headei tiles. 

• QPDFs exception handling mechanism now uses std::logic_error tor internal errors and std::runtime_error 
for runtime errors in favor of the now removed QEXC classes used in pre vious versions. The QEXC exception 
classes predated the addition of the <stdexcepi> header file to the C++ standard library. Most of the exceptions 
thrown by the qpdf library itself are still of type QPDFExc which is now derived from Sidrruntime_error. 
Programs that caught an instance of Std:’.exception and displayed it by calling the whati) method will not need 
to be changed. 

• The QPDFExt class now internail} represents various fields of the error condition and provides interfaces for 
querying them. Among the fields is a numeric error code that can help applications act differently on (a small number 
of) different error conditions. See QPDFExc.hh for details. 

• Warnings can be retrieved from qpdf as instances of QPDFExc instead of strings. 

• The nested QPDF::EncrypxionData class's constructor takes an additional argament. This class is primarily in¬ 
tended to be used by QPDFWrlter. There's not really anything useful an end-user application could do with it. It 
probably shouldn't really be parf of the public interface to begin with. Likewise, some of the methods for computing 
internal encryption dictionary parameters have changed to support /R=4 encryption. 

• The method QPDF::getlJserPassword has been removed since it didn't do what people would think it did. There 
are now two new methods: QPDF::getPuddedVserPassword and QPDF::getTrimmedUserPassword. The first one 
does what the old QPDF:: getUserPassword method used to do, which is to return the password with possible binary 
paddmg as specified by the PDF specification. The second one returns a human-readable password string 

• The enumerated types that used to be nested in QPDFWiiter have moved to top-level enumerated types and are 
now defined in the file qpdf/Constants,h This enables them to be shared by both the C and C++ interfaces. 
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For foe rrfrSt part, foe API forqpdi version 3.0 is backward compatiblewifo vasiors 2.1 and later There aietwo 

etcepfions: 

• Themefood QPDFObjectHandle::replaceStreamData foat uSS5a Sma/n Data Provider fc provide the stream 
chfa no loiter fokesa length paramefer. Whileifvtouidhave beat ea 9/ eiough to keen foepara meter for backward 
oompafibr/rty. in this case foe parameter wasremovedsrnrefo/s provides the user an opportunfy to simplify foe 
call/rg code. This method was introduced rnversAm2.2. At the lime, foe length paramefe was required in order 
to ensurt thafeal/s I> foe stream dafo provide returned foe feme length for a specie stream every time they were 
invoked. In parficliar, th e i in earizaffon ui de depends On fois Instead qptf 3.0 a/Xf newfr check forthat Constraint 
explicitly. 1 he fir, t fime foe stream data provider is called fora Qfic steirn foe acma/ length is saved, and 
subsequent calls are required to reftsn the same number of bytes This means foe calling ode no longer has to 
compute thelengfo in id«rt& wh/dicanbe a srgrificant smolflicatcn. If yourcodefails to conprlebecause of 
theetifo argunent and you don’fwanf tomakeofoer changes to yotreoefes just Quit foe argument 

• Mary methods fake long long insteal of ofoer integer types. Most if not all existing code should compile fine 
with this change since such parameters had always previously been smaller types. This change was required to 
support files larger than two gigabytes in size. 
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Appendix D. Upgrading to 4.0 

While version 4.0 includes a few non-compatible API changes, it is yen' unlikely that anyone's code would have 
used any of those parts of the API since they generally required information that would only be available inside the 
library. In the unlikely event that you should run into trouble, please see the ChangeLog. See also Appendix A, Release 
Notes, page 30 for a complete list of the non-compatible API changes made m this version. 
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